Frequently Asked Questions of Registry Workshop

What is the relationship between registry hives and files?

Windows maintains a list of which hives exist on a particular machine in HKLM\SYSTEM\CurrentControlSet\Control\hivelist. The following table lists standard registry hives and corresponding files.

Regisrty Hive File
HKLM\SAM %SystemRoot%\System32\Config\SAM
HKLM\SECURITY %SystemRoot%\System32\Config\Security
HKLM\SOFTWARE %SystemRoot%\System32\Config\Software
HKLM\SYSTEM %SystemRoot%\System32\Config\System
HKU\.DEFAULT %SystemRoot%\System32\Config\DEFAULT
HKU\SID Documents and Settings\userName\NTUSER.DAT
HKU\SID_Classes Documents and Settings\userName\Local Settings \Application Data\Microsoft\Windows\UsrClass.dat

How can I edit registry on non-bootable Windows system?

You can move the hard disk with the corrupted Windows to another computer, use the Load Hive function to load the registry hive and edit it.

I can not delete a registry key, is there any way to work around this problem?

If you are sure it's not a permission problem, you can try the following steps.

  • Select any registry key and export the key to a registry hive file. For performance reason, please do not select a key contains a lot of subkeys and values.
  • Select the parent key of the key you want to delete. If there are other keys and values in the parent key, move these keys and values to other place or export to a REG file.
  • Import the registry hive file on top of the parent key. This operation will overwrite everything in the parent key.
  • Delete the imported keys and values and restore the old content.

Can I use abbreviation of root keys in the address bar?

Yes, you can use following abbreviations.

Root Key Abbreviation

I see HKLM and HKU in the snapshot. What about HKCR, HKCU and HKCC?

HKLM and HKU contain all registry data. HKCR, HKCU and HKCC are just links.

Root Key Equivalent
HKCR HKCU\Software\Classes + HKLM\SOFTWARE\Classes
HKCC HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current